Inline workers break CSP

[piotrblasiak]

When using CSP (Content Security Policy), inline workers require the use of the script-src blob: policy which is a big no no and opens up the whole website for js injection. Would/is it be possible to load the worker scripts from hosted .js files somehow instead?

[piotrblasiak]

This also applies to stylesheets loaded from cdn.jsdelivr.net - any way we can choose how to load them?

[Yuyz0112]

Hi @piotrblasiak, could you provide a reproducible code for your question? I'm not sure what is the inline workers.

[piotrblasiak]

If you add a Content-Security-Policy header, or html tag like: <meta http-equiv="Content-Security-Policy" content="default-src 'self'"/> You should get a CSP error when trying to use rrweb. I think this is because you are loading web worker code from a blob (inline). You can read more about CSP here: https://content-security-policy.com I hope that explains it.

[cyucelen]

Any updates for this problem?